CVE-2023-4759 - Remote Code Execution (RCE)

Abstract

Arbitrary File Overwrite in Eclipse JGit <= 6.6.0 In Eclipse JGit, all versions <= 6.6.0.202305301015-r, a symbolic link present in a specially crafted git repository can be used to write a file to locations outside the working tree when this repository is cloned with JGit to a case-insensitive filesystem, or when a checkout from a clone of such a repository is performed on a case-insensitive filesystem. This can happen on checkout (DirCacheCheckout), merge (ResolveMerger via its WorkingTreeUpdater), pull (PullCommand using merge), and when applying a patch (PatchApplier). This can be exploited for remote code execution (RCE), for instance if the file written outside the working tree is a git filter that gets executed on a subsequent git command. The issue occurs only on case-insensitive filesystems, like the default filesystems on Windows and macOS. The user performing the clone or checkout must have the rights to create symbolic links for the problem to occur, and symbolic links must be enabled in the git configuration. Setting git configuration option core.symlinks = false before checking out avoids the problem.

The Oxygen products incorporate JGit as a third-party library. This advisory was opened to address the potential impact of this third-party library vulnerability.

Affected Products/Versions

Mitigation

None

Detail

CVE-2023-4759

Severity: High

CVSS Score: 8.8

The JGit third-party library used by Oxygen XML products is an affected version mentioned in CVE-2023-4759 vulnerability description.
Oxygen Content Fusion runs on a case-sensitive filesystem. For that reason, Oxygen Content Fusion is not affected by this vulnerability.

Revision History

2024-03-07 Starting with Oxygen XML Web Author version 26.0.0.1 build 2024022608, the Eclipse JGit was updated to version 5.13.3.202401111512-r, which includes a fix for CVE-2023-4759.